Add install command box and fix Forgejo API proxy on landing page

- nginx.conf: add /forgejo-api/ proxy location to xetup-forgejo:3000
- index.html: add install command box (irm xetup.x9.cz/get.ps1 | iex)
  with one-click copy button; remove broken API token from JS
- get.ps1: PowerShell installer that fetches latest release URL and runs exe

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

web/get.ps1

@@ -0,0 +1,18 @@
+# xetup installer - downloads and launches the latest release
+# Usage: irm xetup.x9.cz/get.ps1 | iex
+
+$api = 'https://xetup.x9.cz/forgejo-api/repos/x9/xetup/releases?limit=1'
+
+try {
+    $rel   = (Invoke-RestMethod -Uri $api -UseBasicParsing)[0]
+    $asset = $rel.assets | Where-Object { $_.name -eq 'xetup.exe' } | Select-Object -First 1
+    if (-not $asset) { Write-Error "xetup.exe not found in latest release"; exit 1 }
+
+    $out = "$env:TEMP\xetup.exe"
+    Write-Host "Downloading xetup $($rel.tag_name)..."
+    Invoke-WebRequest -Uri $asset.browser_download_url -OutFile $out -UseBasicParsing
+    Write-Host "Launching..."
+    Start-Process -FilePath $out -Verb RunAs
+} catch {
+    Write-Error "Failed: $_"
+}

web/index.html

@@ -92,6 +92,28 @@
   }
   .btn-secondary:hover { background: var(--card); }
 
+  /* ---- INSTALL COMMAND ---- */
+  .install-box {
+    margin-bottom: 1.5rem;
+    display: flex; align-items: center; gap: 0;
+    background: #0d1117; border: 1px solid var(--border);
+    border-radius: 10px; overflow: hidden;
+    font-size: .88rem; max-width: 520px; width: 100%;
+  }
+  .install-box code {
+    flex: 1; padding: .65rem 1rem;
+    font-family: 'SFMono-Regular', Consolas, 'Liberation Mono', Menlo, monospace;
+    color: var(--blue); white-space: nowrap; overflow: hidden; text-overflow: ellipsis;
+  }
+  .install-box button {
+    padding: .65rem .9rem; background: var(--card);
+    border: none; border-left: 1px solid var(--border);
+    color: var(--muted); cursor: pointer; font-size: .8rem;
+    transition: color .15s, background .15s; white-space: nowrap;
+  }
+  .install-box button:hover { background: var(--accent); color: #fff; }
+  .install-box button.copied { color: var(--green); }
+
   /* ---- DOWNLOAD STRIP ---- */
   .download-strip {
     margin-bottom: 3.5rem;
@@ -155,6 +177,11 @@
     <a href="https://git.xetup.x9.cz/x9/xetup" class="btn-secondary">Git repozitar</a>
   </div>
 
+  <div class="install-box">
+    <code id="install-cmd">irm xetup.x9.cz/get.ps1 | iex</code>
+    <button id="copy-btn" onclick="copyCmd()">Kopirovat</button>
+  </div>
+
   <!-- Dynamic download strip – filled by JS from Forgejo releases API -->
   <div class="download-strip" id="dl-strip" style="display:none">
     <a id="dl-link" href="#" download>
@@ -204,10 +231,8 @@
 (function() {
   const API  = '/forgejo-api';
   const REPO = 'x9/xetup';
-  const TOKEN = 'e67f674af71847c4349b79b51d2b66a1ea41d031';
-  const HEADS = { 'Authorization': 'token ' + TOKEN };
 
-  fetch(API + '/repos/' + REPO + '/releases?limit=1', { headers: HEADS })
+  fetch(API + '/repos/' + REPO + '/releases?limit=1')
     .then(r => r.json())
     .then(releases => {
       if (!Array.isArray(releases) || !releases.length) return;
@@ -227,6 +252,19 @@
     })
     .catch(() => {});
 })();
+
+function copyCmd() {
+  const cmd = document.getElementById('install-cmd').textContent;
+  const btn = document.getElementById('copy-btn');
+  navigator.clipboard.writeText(cmd).then(function() {
+    btn.textContent = 'Skopirovano!';
+    btn.classList.add('copied');
+    setTimeout(function() {
+      btn.textContent = 'Kopirovat';
+      btn.classList.remove('copied');
+    }, 2000);
+  });
+}
 </script>
 
 </body>

web/nginx.conf

@@ -14,5 +14,15 @@ server {
         add_header X-Content-Type-Options nosniff always;
     }
 
+    # Proxy Forgejo API calls so browser doesn't need CORS or direct access to Forgejo
+    location /forgejo-api/ {
+        proxy_pass         http://xetup-forgejo:3000/api/v1/;
+        proxy_set_header   Host              xetup-forgejo;
+        proxy_set_header   X-Real-IP         $remote_addr;
+        proxy_set_header   X-Forwarded-For   $proxy_add_x_forwarded_for;
+        proxy_set_header   X-Forwarded-Proto $scheme;
+        add_header         Cache-Control "no-store" always;
+    }
+
     error_page 404 /404.html;
 }